Restricting access to application programming interfaces (APIs)
Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.
1. A system for determining a trust level of a process associated with a call operation, comprising:
a processor; and
memory storing instructions that, when executed by the processor, causes the system to perform a set of operations, the set of operations comprising:
receiving a call operation associated with a process, the call operation having an associated call stack that stores a return address for the call operation;
responsive to receiving the call operation associated with the process, determining whether the process is known by a security service;
after receiving the call operation associated with the process and determining whether the process is known by a security service:
responsive to determining that the process is known by the security service, determining a trust level for the process and responsive to determining that the process is both known and trusted based on the trust level for the process, allowing the known process to execute the call operation;
responsive to determining that the process is unknown by the security service, determining whether the call operation is known by the security service, comprising accessing a data store to analyze the call stack;
responsive to determining that the process is unknown by the security service and that the call operation is known by the security service, evaluating the trust level of the call operation and responsive to determining that the called operation is both known and trusted based on the trust level of the call operation, trusting the unknown process and executing the call operation; and
responsive to determining that the process is unknown by the security service and that the call operation is unknown by the security service, not trusting the process and not executing the call operation.
2. The system of claim 1 , wherein the call operation is that of an application programming interface (API) and an API hook is used to intercept the call operation.
3. The system of claim 2 , wherein the process comprises a process to find a file, the trust level evaluated for a file search operation that comprises a wildcard symbol.
4. The system of claim 1 , wherein determining whether the process is known by the security service comprises accessing a data store to compare attributes of the process to a set of attributes for known processes.
5. The system of claim 4 , wherein the set of attributes for known processes comprises a list of historical data for known processes and comparing attributes comprises comparing a process name, a process hash, or a process cryptographic signature to the historical data for known process.
6. The system of claim 1 , wherein determining whether the call operation is known by the security service comprises accessing the data store to compare attributes of the call stack for the call operation to a set of attributes for known call operations.
7. The system of claim 6 , wherein the set of attributes for known call operations comprises historical data for known call operation including a security certificate and comparing attributes comprises comparing a security certificate for the call operation to the historical data for known call operations.
8. The system of claim 1 , wherein determining the trust level of the process includes accessing the data store to evaluate the call stack associated with the process, including evaluating a call stack attribute stored in the call stack.
9. A method for determining a trust level of a process associated with a call operation, comprising:
receiving a call operation associated with a process, the call operation having an associated call stack that stores a return address for the call operation;
responsive to receiving the call operation associated with the process, determining whether the process is known by a security service;
after receiving the call operation associated with the process and determining whether the process is known by a security service:
responsive to determining that the process is known by the security service, determining the trust level for the process and responsive to determining that the process is both known and trusted based on the trust level for the process, allowing the known process to execute the call operation;
responsive to determining that the process is unknown by the security service, determining whether the call operation is known by the security service, including accessing a data store to analyze the call stack;
responsive to determining that the process is unknown by the security service and that the call operation is known by the security service, evaluating the trust level of the call operation and responsive to determining that the called operation is both known and trusted based on the trust level of the call operation, trusting the unknown process and executing the call operation; and
responsive to determining that the process is unknown by the security service and that the call operation is unknown by the security service, not trusting the process and not executing the call operation.
10. The method of claim 9 , wherein the call operation is that of an application programming interface (API) and an API hook is used to intercept the call operation.
11. The method of claim 10 , wherein the process comprises a process to find a file, the trust level evaluated for a file search operation that comprises a wildcard symbol.
12. The method of claim 9 , wherein determining whether the process is known by the security service comprises accessing a data store to compare attributes of the process to a set of attributes for known processes.
13. The method of claim 12 , wherein the set of attributes for known processes comprises a list of historical data for known processes and comparing attributes comprises comparing a process name, a process hash, or a process cryptographic signature to the historical data for known process.
14. The method of claim 9 , wherein determining whether the call operation is known by the security service comprises accessing the data store to compare attributes of the call stack for the call operation to a set of attributes for known call operations.
15. The method of claim 14 , wherein the set of attributes for known call operations comprises historical data for known call operation including a security certificate and comparing attributes comprises comparing a security certificate for the call operation to the historical data for known call operations.
16. The method of claim 9 , wherein determining the trust level of the process includes accessing the data store to evaluate the call stack associated with the process, including evaluating a call stack attribute stored in the call stack.
17. A computer storage device storing a set of computer-executable instructions that, when executed, are capable of performing a method for determining a trust level of a process associated with a call operation, the set of computer-executable instructions comprising instructions for:
receiving a call operation associated with a process, the call operation having an associated call stack that stores a return address for the call operation;
responsive to receiving the call operation associated with the process, determining whether the process is known by a security;
after receiving the call operation associated with the process and determining whether the process is known by a security service:
responsive to determining that the process is known by the security service, determining the trust level for the process and responsive to determining that the process is both known and trusted based on the trust level for the process, allowing the known process to execute the call operation;
responsive to determining that the process is unknown by the security service, determining whether the call operation is known by the security service, including accessing a data store to analyze the call stack;
responsive to determining that the process is unknown by the security service and that the call operation is known by the security service, evaluating the trust level of the call operation and responsive to determining that the called operation is both known and trusted based on the trust level of the call operation, trusting the unknown process and executing the call operation; and
responsive to determining that the process is unknown by the security service and that the call operation is unknown by the security service, not trusting the process and not executing the call operation.
18. The computer storage device of claim 17 , wherein the call operation is that of an application programming interface (API) and an API hook is used to intercept the call operation.
19. The computer storage device of claim 17 , wherein determining whether the process is known by the security service comprises accessing a data store to compare attributes of the process to a set of attributes for known processes.
20. The computer storage device of claim 19 , wherein the set of attributes for known processes comprises a list of historical data for known processes and comparing attributes comprises comparing a process name, a process hash, or a process cryptographic signature to the historical data for known process.
21. The computer storage device of claim 17 , wherein determining whether the call operation is known by the security service comprises accessing a data store to compare attributes of the call stack for the call operation to a set of attributes for known call operations.
22. The computer storage device of claim 21 , wherein the set of attributes for known call operations comprises historical data for known call operation including a security certificate and comparing attributes comprises comparing a security certificate for the call operation to the historical data for known call operations.
23. The computer storage device of claim 17 , wherein determining the trust level of the process includes accessing the data store to evaluate the call stack associated with the process, including evaluating a call stack attribute stored in the call stack.